[PATCH] RDMA/mlx5: Validate priority in STEERING_ANCHOR_CREATE handler

[PATCH] RDMA/mlx5: Validate priority in STEERING_ANCHOR_CREATE handler

[Serhat Kumral]

In MLX5_IB_METHOD_STEERING_ANCHOR_CREATE, the user-supplied u16 priority
is passed directly to _get_flow_table() without an upper bound check.
This can lead to out-of-bounds array accesses on dev->flow_db priority
tables.

Check that priority does not exceed MLX5_IB_FLOW_LAST_PRIO before calling
_get_flow_table(), matching the existing validation in raw_fs_rule_add()
and mlx5_ib_create_flow().

Fixes: 0c6ab0ca9a66 ("RDMA/mlx5: Expose steering anchor to userspace")
Signed-off-by: Serhat Kumral <serhatkumral1@gmail.com>
---
found by smatch:
- drivers/infiniband/hw/mlx5/fs.c:2013 _get_flow_table() error: buffer overflow 'dev->flow_db->fdb' 16 <= u16max user_rl='0-u16max'

 drivers/infiniband/hw/mlx5/fs.c | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/drivers/infiniband/hw/mlx5/fs.c b/drivers/infiniband/hw/mlx5/fs.c
index e63fdb4bc3e3..bc2c15c7172b 100644
--- a/drivers/infiniband/hw/mlx5/fs.c
+++ b/drivers/infiniband/hw/mlx5/fs.c
@@ -3014,6 +3014,9 @@ static int UVERBS_HANDLER(MLX5_IB_METHOD_STEERING_ANCHOR_CREATE)(
 	if (err)
 		return err;
 
+	if (priority > MLX5_IB_FLOW_LAST_PRIO)
+		return -EINVAL;
+
 	obj = kzalloc_obj(*obj);
 	if (!obj)
 		return -ENOMEM;
-- 
2.53.0

Re: [PATCH] RDMA/mlx5: Validate priority in STEERING_ANCHOR_CREATE handler

[sashiko-bot]

> In MLX5_IB_METHOD_STEERING_ANCHOR_CREATE, the user-supplied u16 priority
> is passed directly to _get_flow_table() without an upper bound check.
> This can lead to out-of-bounds array accesses on dev->flow_db priority
> tables.
> 
> Check that priority does not exceed MLX5_IB_FLOW_LAST_PRIO before calling
> _get_flow_table(), matching the existing validation in raw_fs_rule_add()
> and mlx5_ib_create_flow().
> 
> Fixes: 0c6ab0ca9a66 ("RDMA/mlx5: Expose steering anchor to userspace")
> Signed-off-by: Serhat Kumral <serhatkumral1@gmail.com>

Sashiko has reviewed this patch and found no issues.

-- 
Sashiko AI review · https://sashiko.dev/#/patchset/20261018144907.20123-1-serhatkumral1@gmail.com?part=1